Support network_proxy in managed requirements (#57286)

## What changed

Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.

Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.

## Testing

Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.

GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302

sdk/python/src/openai_codex/generated/v2_all.py

@@ -2924,8 +2924,7 @@ class NetworkRequirements(BaseModel):
         ),
     ] = None
     domains: Annotated[
-        dict[str, Any] | None,
-        Field(description="Canonical network permission map for `experimental_network`."),
+        dict[str, Any] | None, Field(description="Canonical managed network permission map.")
     ] = None
     enabled: bool | None = None
     http_port: Annotated[int | None, Field(alias="httpPort", ge=0)] = None
@@ -2946,10 +2945,7 @@ class NetworkRequirements(BaseModel):
     socks_port: Annotated[int | None, Field(alias="socksPort", ge=0)] = None
     unix_sockets: Annotated[
         dict[str, Any] | None,
-        Field(
-            alias="unixSockets",
-            description="Canonical unix socket permission map for `experimental_network`.",
-        ),
+        Field(alias="unixSockets", description="Canonical managed unix socket permission map."),
     ] = None